Merge pull request #667 from CleanTalk/fix_vuln_weak_spot_av

Fix. Scanner. Editing the data preparation in the table

Author: AntonV1211

inc/spbc-settings.php

@@ -2124,10 +2124,12 @@ function spbc_field_scanner__prepare_data__files(&$table)
                     if ( ! empty($weak_spots['SIGNATURES']) && $signatures) {
                         foreach ($weak_spots['SIGNATURES'] as $_string => $weak_spot_in_string) {
                             foreach ($weak_spot_in_string as $weak_spot) {
-                                $ws_string .= '<span class="spbcRed"><i setting="signatures_' . $signatures[ $weak_spot ]->attack_type . '" class="spbc_long_description__show spbc-icon-help-circled"></i>' . $signatures[ $weak_spot ]->attack_type . ': </span>'
-                                             . (strlen($signatures[ $weak_spot ]->name) > 30
-                                        ? substr($signatures[ $weak_spot ]->name, 0, 30) . '...'
-                                        : $signatures[ $weak_spot ]->name);
+                                $attack_type = isset($signatures[ $weak_spot ]) ? $signatures[ $weak_spot ]->attack_type : '';
+                                $sig_name = isset($signatures[ $weak_spot ]) ? $signatures[ $weak_spot ]->name : '';
+                                $ws_string .= '<span class="spbcRed"><i setting="signatures_' . esc_attr($attack_type) . '" class="spbc_long_description__show spbc-icon-help-circled"></i>' . esc_html($attack_type) . ': </span>'
+                                             . (strlen($sig_name) > 30
+                                        ? esc_html(substr($sig_name, 0, 30)) . '...'
+                                        : esc_html($sig_name));
                             }
                         }
                     }
@@ -2139,10 +2141,10 @@ function spbc_field_scanner__prepare_data__files(&$table)
                         }
                         $all_unique_weak_spots = array_unique($all_unique_weak_spots);
                         foreach ($all_unique_weak_spots as $weak_spot_in_string) {
-                            $ws_string .= '<p style="margin: 0;"><span class="spbcRed"><i setting="heuristic_' . str_replace(' ', '_', $weak_spot_in_string) . '" class="spbc_long_description__show spbc-icon-help-circled"></i> Heuristic: </span>'
+                            $ws_string .= '<p style="margin: 0;"><span class="spbcRed"><i setting="heuristic_' . esc_attr(str_replace(' ', '_', $weak_spot_in_string)) . '" class="spbc_long_description__show spbc-icon-help-circled"></i> Heuristic: </span>'
                                     . (strlen($weak_spot_in_string) > 30
-                                    ? substr($weak_spot_in_string, 0, 30) . '...'
-                                    : $weak_spot_in_string);
+                                    ? esc_html(substr($weak_spot_in_string, 0, 30)) . '...'
+                                    : esc_html($weak_spot_in_string));
                             $ws_string .= '</p>';
                         }
                     }
@@ -2154,10 +2156,10 @@ function spbc_field_scanner__prepare_data__files(&$table)
                         }
                         $all_unique_weak_spots = array_unique($all_unique_weak_spots);
                         foreach ($all_unique_weak_spots as $weak_spot_in_string) {
-                            $ws_string .= '<p style="margin: 0;"><span class="spbcRed"><i setting="suspicious_' . str_replace(' ', '_', $weak_spot_in_string) . '" class="spbc_long_description__show spbc-icon-help-circled"></i> Suspicious: </span>'
+                            $ws_string .= '<p style="margin: 0;"><span class="spbcRed"><i setting="suspicious_' . esc_attr(str_replace(' ', '_', $weak_spot_in_string)) . '" class="spbc_long_description__show spbc-icon-help-circled"></i> Suspicious: </span>'
                                 . (strlen($weak_spot_in_string) > 30
-                                ? substr($weak_spot_in_string, 0, 30) . '...'
-                                : $weak_spot_in_string);
+                                ? esc_html(substr($weak_spot_in_string, 0, 30)) . '...'
+                                : esc_html($weak_spot_in_string));
                             $ws_string .= '</p>';
                         }
                     }
@@ -2169,7 +2171,7 @@ function spbc_field_scanner__prepare_data__files(&$table)
                         }
                         $all_unique_weak_spots = array_unique($all_unique_weak_spots);
                         foreach ($all_unique_weak_spots as $weak_spot_in_string) {
-                             $ws_string .= '<p style="margin: 0;"><span class="spbcRed"><i setting="hash_' . str_replace(' ', '_', $weak_spot_in_string) . '" class="spbc_long_description__show spbc-icon-help-circled"></i> Hash: </span>'
+                             $ws_string .= '<p style="margin: 0;"><span class="spbcRed"><i setting="hash_' . esc_attr(str_replace(' ', '_', $weak_spot_in_string)) . '" class="spbc_long_description__show spbc-icon-help-circled"></i> Hash: </span>'
                                 . 'denied';
 
                             $ws_string .= '</p>';
@@ -2205,7 +2207,7 @@ function spbc_field_scanner__prepare_data__files(&$table)
                     $errors = json_decode($row->error_msg, true);
                     if (!empty($errors)) {
                         foreach ($errors as $_key => $_val) {
-                            $parsed_item_error .= '<p>' . $_key . ': ' . $_val . '</p>';
+                            $parsed_item_error .= '<p>' . esc_html($_key) . ': ' . esc_html($_val) . '</p>';
                         }
                     } else {
                         $parsed_item_error = 'Unknown error';
@@ -2272,12 +2274,12 @@ function spbc_field_scanner__prepare_data__analysis_log(&$table)
                     }
                     break;
                 default:
-                    $pscan_status = $row->pscan_processing_status;
+                    $pscan_status = esc_html($row->pscan_processing_status);
                     $analysis_comment = 'Not scanned by Cloud or CleanTalk team.';
             }
 
             if ( isset($row->status) && $row->status === 'QUARANTINED' ) {
-                $pscan_status = $row->pscan_status;
+                $pscan_status = esc_html($row->pscan_status);
                 $analysis_comment = __('Quarantined by user', 'security-malware-firewall');
             }